1

So our security team had an investigation in our sharepoint site and one of the things they've mention is

DESCRIPTION

"The application does not implement “no-store” and/or “no-cache” setting for Cache-Control and “no-cache” for Pragma headers in all of its pages. This allows SSL pages to be cached and sensitive information can be gathered which can aid an attacker on how to customize its script to exploit the application."

RECOMMENDATION

"Restrict the ability to cache application pages that contain sensitive data by implementing "Cache-Control: no-store" and either "Pragma: no-cache" or "Cache-Control: no-cache" response directives."

How can i do that?

Thanks!

0

If you develop a custom app you have to set headers of your calls as suggested:
Cache-Control: no-store
Pragma: no-cache

.js example:

fetch(url, {
    method: 'POST',
    headers: {
        'Cache-Control': 'no-cache',
        'Pragma': 'no-cache',
        ...
    },
    body: ...
}

.NET example:

var client = new HttpClient(handler);
client.DefaultRequestHeaders.TryAddWithoutValidation("Cache-Control", "no-cache");
client.DefaultRequestHeaders.TryAddWithoutValidation("Pragma", "no-cache");

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.